Addendum to "Quantum secret sharing between multiparty and multiparty without 

entanglement" 
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Recently, Yan and Gao proposed a quantum secret sharing protocol between multiparty (m mem- 
bers in group 1) and multiparty (n members in group 2) using a sequence of single photons (Phys. 
Rev. A 72, 012304 (2005)). We find that it is secure if the quantum signal transmitted is only 
a single photon but insecure with a multi-photon signal as some agents can get the information 
about the others' message if they attack the communication with a Trojan horse. However, security 
against this attack can be attained with a simple modification. 

PACS numbers: 03.67.Dd, 03.67.Hk, 89.70.+C 
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In general, secret sharing [l| is used to split a mes- 
sage (Ma) into several pieces which are distributed to 
several agents. When the agents collaborate, they can 
obtain the message, otherwise they can get nothing. 
Quantum secret sharing (QSS) is the generalization of 
classical secret sharing into quantum scenario and be- 
comes an important branch of quantum communica- 
tion. It provides a secure way for not only creating 
a private key among several users 0, 0, 0, IE IE 01 
but also splitting a piece of classical secret message 
or quan tum information (an unknown quantum state) 
[SMEHQEEIIIIII- It has progressed 
quickly since Hillery, Buzek and Berthiaume proposed 
the original QSS protocol using a three-photon entangled 
Greenberger-Horne-Zeilinger states, and attracts a lot of 
attentions in recentyears Mlljl IEIE0I1IEEEE1E1 
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Recently, Yan and Gao E3 presented a novel concept 
for quantum secret sharing of classical information (a pri- 
vate key), i.e., QSS between group 1 and group 2 with 
polarized single photons. It is secure if the quantum sig- 
nal transmitted is only a single photon but insecure with 
a multi-photon signal as some agents can get the infor- 
mation about the others' message if they attack the com- 
munication with a Trojan horse. In this paper, we will 
discuss this attack and improve the security of Yan-Gao 
QSS protocol against this attack with a little of modifi- 
cation. 

The basic idea of Yan-Gao QSS protocol [lj| can be 
described as follows. The members of group 1 are Alice 1, 
Alice 2,..., and Alice to, and those for group 2 are Bob 1, 
Bob 2, and Bob n. Group 1 wants to share a private 
key with group 2 in such a way that the key can be read 



out only when all members in each group cooperate. This 
task can be completed with six steps as follows. 

(1) Alice 1 generates two random binary strings Ai and 
Bi whose length is nN bits. She also prepares nN qubits 
and divides it into to n pieces. Each piece contains N 
qubits. Each qubit is in one of the four states 
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where |0) and |1) are the two eigenvectors of the operator 
o z (called it the measuring basis (MB) Z), and |+) and 
|— ) are those of the operator a x . That is, Alice 1 prepares 
the qubits according to the bit values in A\ and B\ . The 
four states |0), |1), |+), and |— ) correspond to the codes 

00, 10, 01, and 11, respectively. The first bit in each 
code comes from the A\ and represents the information 
of the eigenvalue correlated to the state, and the second 
bit comes from the B\ and represents the MB of the state, 

1. e., the state is the eigenvector of Z if the second bit is 

0, otherwise the state is the eigenvector of X. Alice 1 
sends the nN qubits to Alice 2. 

(2) Similar to Alice 1, Alice 2 creates two random bi- 
nary strings A 2 and B 2 . She operates each of the nN 
qubits according to the bits in the two strings in turn, 

1. e., if the bit in A 2 is 0, she performs the unitary op- 
eration I = |0)(0| + |1)(1| on the qubit, otherwise she 
performs the unitary operation U = ia y = |0)(1| — |1)(0|. 
Simultaneously she has to operate the qubit according 
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to the bit in i?2- That is, if the bit in B2 is 0, she sup- 
plies the unitary operation I on the qubit, otherwise she 
performs a Hadamard (H) operator on it. After the two 
operations on each qubit, Alice 2 sends the nN qubits to 
Alice 3. 

The nice feature of the operation U is that it flips the 
state in both measuring bases |iL I22I l23| . i.e., 

tf|0> = -|l>, U\1) = \0), (5) 
U\+) = \~), U\-) = -\+). (6) 

The H operation can transfer the states between the two 
MBs, Z and X [H[l3|, i.e., 

H\0) = \+), H\l) = |->, (7) 
H\+) = \0), H\-) = \l). (8) 

After the two operations done by Alice 2, the photon 
is randomly in one of the four states {|0), |1), |+), |— )}, 
which will prevent Alice 1 from eavesdropping freely if 
there is one photon in each signal. 

(3) Alice i operates the qubits like Alice 2, i = 
3, 4, . . . , m. 

(4) Alice to sends N qubits to each member of group 
2, Bob j (J = 1, 2, . . . , n) in turn. After they receive the 
qubits, the members of group 1 publicly announce the 
strings B\, B2, ■ ■ and B m , which will reveal the infor- 
mation about the MB of each qubit operated by Alice i 
(i = l,2,...,m). 

(5) Bob j measures each of his qubits with MB Z or X 
according to the XOR (i.e., 0) results of corresponding 
bits in the strings Bi, B%, . . ., and B m . 

(6) All members in group 1 check eavesdropping of this 
quantum communication. If the channel is secure, the 
XOR results of Bob j's corresponding bits can be used 
as key bits for secret sharing. 

Yan-Gao protocol may be secure for each member in 
group 2, say Bob j, as group 1 can detect the eavesdrop- 
ping done by them, as the same as BB84 quantum key 
distribution protocol j2^|. But the eavesdropping done 
by some members in group 1 is difficult to be detected, 
in particular some agents in group 1 eavesdrop the com- 
munication with a multi-photon signal. We will discuss 
the security of Yan-Gao protocol and present a possible 
improvement of Yan-Gao protocol security. 

The attack done by Alice 1 with a Trojan horse works 
as follows. She prepares two photons in the same state 
and sends them to Alice 2. After operations have been 
done by the other members in group 1, Alice 1 intercepts 
the signal and separates a photon from the signal with 
a photon number splitter (PNS: 50/50). She sends the 
other one in each signal to the members in group 2. After 
Alice i (i = 1,2,..., to) announces the strings B%, B2, ■ ■ 
and B m , Alice 1 can obtain the key freely without the 
help of the others in group 1. It means that Yan-Gao 
protocol is not secure for Alice 1. Of course, an eaves- 
dropper, Eve (who can be any one of Alice 2, Alice 3, 
Alice to) can steal almost all the information about 
the unitary operation done by any member in group 1 



with a multi-photon Trojan horse attack except for Alice 
1, as the same as that in Ref. ^3|. That is, Eve inter- 
cepts the original signal and sends Alice i 2 K+1 photons 
in the same state, say <f>o = |0). After the operation is 
done by Alice i, Eve intercepts the photons and measures 
with two MBs after splitting it using some PNSs. In de- 
tail, Eve measures half of the photons with MB Z, and 
the others with MB X. The effect of the two operations 
{J, U} according to and {/, H} corresponding to Bi 
done by Alice i is equivalent to one of the four opera- 
tions {/, U, H, H} chosen according to the two bits from 
AiandBi. Here if = ^-(-|0)(0| + |0)(1| + |1)(0| + |1)(1|). 
The task of the eavesdropping done by Eve is simplified 
to distinguish the four unitary operations. However, they 
can be distinguished with sufficiently enough photons. If 
Alice i performs one of the two operations {/, U} on the 
fake signal, the outcomes of the measurements on the 
2 K photons with MB Z are the same one, otherwise the 
outcomes are different. The same result can be obtained 
with the measurements on the other 2 K photons with MB 
X if Alice i performs one of the two operations {H, H} on 
the fake signal. Thus, quantum secret sharing between 
to members and n members turns into that between t 
members (t < to) and n members. However, since Alice 
1 keep A\ in secret and Eve can not get the informa- 
tion A\ of Alice 1, so two groups still share a secure key. 
In a word, Yan-Gao protocol is not secure only if Alice 
1 replaces the single-photon signal with a multi-photon 
one. 

In essence, the attack comes from the two facts: one is 
that the member in group 1 does not determine whether 
there is one photon in each quantum signal received 
or more; the other is that the member does not know 
whether an eavesdropper intercepts the original signal. 

For improving the security of Yan-Gao protocol 0] , a 
photon number splitter (PNS: 50/50) and single-photon 
measurements are necessary for each of the members in 
group 1, as the same as that in Ref. 0], except for 
Alice 1, the one who prepares the original signal. The 
measurements with a PNS is shown in Fig.l. That is, 
Alice I chooses randomly a sufficiently enough subset of 
the nN photons as the samples for eavesdropping check, 
and measures each sample with a PNS and two single- 
photon detectors after the original quantum signals are 
transmitted from Alice I — 1 to her, see Fig.l. 

For the integrity, let us describe all the steps of this 
modified Yan-Gao protocol as follows, including some 
steps same as those in the original one |l9j . 

(Ml) Same as the first step in the original Yan-Gao 
protocol, Alice 1 prepares nN qubits and each qubit is in 
one of the four states {|0), |1), |+), |— )} according to the 
bits in the two binary strings A\ and B±. She sends the 
qubits to Alice 2. 

(M2) Similar to Alice 1, Alice 2 create two binary 
strings A2 and B^. For each of the nN qubits, she per- 
forms the operation / (U) on it if the corresponding bit 
in A\ is (1). Simultaneously she has to operate the 
qubit with / or H according to the corresponding bit in 
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FIG. 1: (Color online) The measurements with a photon 
number splitter (PNS: 50/50), similar to that in Ref. [l^l. 
The members in group 1 choose one of the two MBs, Z and 
X, randomly to measure each signal after the PNS. 



i?2 is or 1, respectively. She sends the photons to Alice 
3. 

Certainly, before Alice 2 operates the nN photons, she 
chooses randomly a sufficiently enough subset of photons 
as the samples for eavesdropping check. First, she splits 
each sample signal with a PNS, and then measures each 
signal with the MB Z or X choosing randomly, shown 
in Fig.l. Moreover, she should analyze the error rate e s 
of the samples by means that she requires Alice 1 to tell 
her the original states of the samples. If the error rate is 
reasonably lower than the threshold et, Alice 2 continues 
the quantum communication to next step, otherwise she 
aborts it. 

(M3) Alice i operates the qubits like Alice 2, i = 
3, 4, . . . , m. For analyzing the error rate of the samples, 
she requires all the members before her to tell her the 



original state or the operations they chose. 

(M4) Alice m sends N qubits to each member in group 
2, Bob j (j = 1, 2, . . . , n) in turn. After they receive their 
qubits, the members in group 1 publicly announce the 
strings B X ,B 2 ,.. -,B m . 

(M5) Bob j measures each of his qubits with the MB 
Z or X according to the XOR (i.e., ©) results of corre- 
sponding bits in the strings B±, B%, ■ ■ . , B m . 

(M6) All members in group 1 complete the error rate 
analysis of the transmission between the two groups. To 
this end, all Alice require each of the member in group 
2 to publish a subset of results chosen randomly, and 
analyze the error rates of the samples. If the channel is 
secure, the XOR results of Bob j's corresponding bits can 
be used as key bits for secret sharing, otherwise they dis- 
card the results obtained and repeat the quantum com- 
munication from the beginning. 

In fact, this modified Yan-Gao protocol is secure with 
just a little of modification of the original Yan-Gao proto- 
col |l9j . That is, each of the members in group 1 performs 
an eavesdropping check for the transmission of the qubits 
with a PNS and two single-photon detectors. The prin- 
ciple of the eavesdropping checks is the same as that in 
BB84 quantum key distribution protocol So the 

transmission of qubits between two authorized members 
in the two groups is secure. 
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